xworm | 7ba2a1c494347fc81d2b5785c23b4fc1d0f7975bbab909316caf883c04e7729e

Analysis

max time kernel
116s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2024, 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ba2a1c494347fc81d2b5785c23b4fc1d0f7975bbab909316caf883c04e7729eN.exe
Size

2.6MB
MD5

a484585e14cd5969b39115a028b8ea30
SHA1

f546ebec7aa938de617458c43d8c4c41c07b080f
SHA256

7ba2a1c494347fc81d2b5785c23b4fc1d0f7975bbab909316caf883c04e7729e
SHA512

9d2041826c57bed82763cdb7691750a6be99f5bf9185e6a393556a879f740f6f9c3b0c6a1541df0699820942bea24064a265fe184ce6650cd0f2333a53a8ca59
SSDEEP

24576:t98MhLDZfqHV4pE+kdfOfulNneCRxZjSP9NW32up92mpxviIGLnyMbOyvlya:t9jhLDtq1yGfOYfxtW9Il7GLFHv

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

v5kAoJPk1tZiHfvf

Attributes

Install_directory
%Public%
install_file
Windows Security Health Host.exe
pastebin_url
https://pastebin.com/raw/nV1XKCv3

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023c82-5.dat	family_xworm
behavioral2/memory/544-8-0x0000000000840000-0x0000000000850000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Security Health Host.lnk	Windows Security Health Host.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Security Health Host.lnk	Windows Security Health Host.exe

Executes dropped EXE 1 IoCs

pid	Process
544	Windows Security Health Host.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Security Health Host = "C:\\Users\\Public\\Windows Security Health Host.exe"	Windows Security Health Host.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	pastebin.com
13	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	544	Windows Security Health Host.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 544	4264	7ba2a1c494347fc81d2b5785c23b4fc1d0f7975bbab909316caf883c04e7729eN.exe	83
PID 4264 wrote to memory of 544	4264	7ba2a1c494347fc81d2b5785c23b4fc1d0f7975bbab909316caf883c04e7729eN.exe	83
PID 4264 wrote to memory of 4936	4264	7ba2a1c494347fc81d2b5785c23b4fc1d0f7975bbab909316caf883c04e7729eN.exe	84
PID 4264 wrote to memory of 4936	4264	7ba2a1c494347fc81d2b5785c23b4fc1d0f7975bbab909316caf883c04e7729eN.exe	84

C:\Users\Admin\AppData\Local\Temp\7ba2a1c494347fc81d2b5785c23b4fc1d0f7975bbab909316caf883c04e7729eN.exe
"C:\Users\Admin\AppData\Local\Temp\7ba2a1c494347fc81d2b5785c23b4fc1d0f7975bbab909316caf883c04e7729eN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Public\Windows Security Health Host.exe
  "C:\Users\Public\Windows Security Health Host.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\34313cccf98b1cbc.bat
  2⤵
  PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\34313cccf98b1cbc.bat

Filesize
250B

MD5
08292d961054f2d45e2b2f6579a2296a

SHA1
d7803dfe3711c43bca27fa429fcb8e0a61115507

SHA256
da64a536f3215d6482c9d476f5f85e881e9ad8f9d6572db94363779b1e4c940b

SHA512
85e18594c1c23a3e7e7fb923c0c31915c511bff1a352464049a044106b701d074e4fd4eccccc5d882830baf8bc198fe706edb1038e48137c74d44e215a830ce2

Download Submit
C:\Users\Public\Windows Security Health Host.exe

Filesize
35KB

MD5
6887cb1cca8b65ac273b5724b7c119ae

SHA1
85056c310027624af2a0de68c4d05270ad48e425

SHA256
069af8cf73aa86db803f4502a673417bb470d04d5b504b84e9f0932314625b76

SHA512
159239e9b67e0f1b1bc7a796d92487044b68b91ffeec1a58a684ffe50a5f9232b51845106066c89f6d81fee7c8a8cb94dedb1aa021a145babcd3bc9860b80adb

Download Submit
memory/544-7-0x00007FFA473E3000-0x00007FFA473E5000-memory.dmp

Filesize
8KB

Download
memory/544-8-0x0000000000840000-0x0000000000850000-memory.dmp

Filesize
64KB

Download
memory/544-11-0x00007FFA473E0000-0x00007FFA47EA1000-memory.dmp

Filesize
10.8MB

Download
memory/544-12-0x00007FFA473E3000-0x00007FFA473E5000-memory.dmp

Filesize
8KB

Download
memory/544-13-0x00007FFA473E0000-0x00007FFA47EA1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads